sys-cmd support

sys-cmd support is the support bundle command that, in WEB-CLI, collects in a single zip file the evidence that the TR7 support team needs in order to examine a problem — the system state, the services, the vService states, the network information, the graph data, the masked configuration and the service logs. The bundle is anonymized by default: the IP addresses, the domain names, the object names and the e-mail addresses are in the bundle with consistent pseudonyms. It has two subcommands: collect produces the bundle, and list lists the bundles that have been produced.

Command Summary

TR7 WEB-CLI · sys-cmd support

# type support and press Tab

admin@TR7LBWAF01> sys-cmd support

collect  list

 

# type collect and press Tab twice: the first press writes --, the second lists the fields

admin@TR7LBWAF01> sys-cmd support collect

--escrow-map  --modules  --pool  --profile  --seal  --since  --skip-vendor

 

admin@TR7LBWAF01> sys-cmd support collect

admin@TR7LBWAF01> sys-cmd support list

admin@TR7LBWAF01>  

There is no mandatory field in this command. When support collect is written on its own, it produces a bundle with the anonymous profile, with the logs of the last 7 days and with all the modules.

sys-cmd support collect

The Fields

Field	What it does	What is written after it
--profile	Selects the privacy profile of the bundle	anon (the default) · minimal · full — in the table below
--since	Determines how far back the log and record files will go	A number of 1–3 digits and h (hours) or d (days): 12h · 7d · 20d. The default is 7d, and the most is 30d
--modules	Collects only the specified modules	Module names separated by commas: system,network. No space is left after the comma; if one is left, the next name counts as a separate word and gives a Command not found error. The default: all of them
--pool	Narrows the vService states and the vService configurations in the vendor compartment to a single vService	A vService id; letters, digits, _ and -, at most 64 characters
--skip-vendor	Does not put the encrypted vendor compartment in the bundle at all	No value is written
--seal	Puts the customer content in an encrypted envelope as well; only the manifest and the summary stay in the bundle as plain text	No value is written
--escrow-map	Adds the table that shows the real equivalents of the pseudonyms to the encrypted vendor compartment; it asks for confirmation first	No value is written

The fields are written with the -- prefix and in any order. The vService ids are seen in the output of lb service list.

The Privacy Profiles

--profile	What goes into the bundle
anon	All the modules are collected. The IP and MAC addresses, the e-mail addresses and the known host and object names are converted into consistent pseudonyms inside the bundle. The traffic volumes, the time patterns, the identity numbers, the port numbers that are not internal and the user names inside free text are not anonymized. The binary files that cannot be anonymized are not put in the bundle.
minimal	The service logs, the component logs, the vService logs and the network detail are not collected at all; the configuration is reduced to a structure summary only. The remaining content is anonymized like anon.
full	Everything is collected as it is, without being anonymized.

The Modules

Module	Content
system	The processor, the memory, the disk usage, the running processes, the time synchronization state and the system warnings
services	The running state of the services and the last lines of the TR7 service logs
vservices	The vService states, the state change records and the backend health check records
network	The addresses, routes and connection summaries of the device and the route tables
containers	The list of the TR7 components, their resource usage and the last lines of their logs
metrics	The processor, memory, load and network graph data of the last 24 hours
config	The configuration files with the passwords and the secret values masked, and the device id
journals	The service logs; limited by the --since window. It is not collected with the minimal profile
vendor	The encrypted vendor compartment that only the TR7 support team can open

The modules are always collected in the order in this table; --modules determines only which of them will be collected.

Examples

TR7 WEB-CLI · A) The default bundle

admin@TR7LBWAF01> sys-cmd support collect

collect started (profile=anon, since=7d, modules=system,services,vservices,network,containers,metrics,config,journals,vendor, budget=256MB)

[system] collecting...

[system] ok (…)

…

done: support-<device>-<date-time>.zip (…KB)

Bundle ready: support-<device>-<date-time>.zip (…)

https://<management-address>/api/sys_cmd/files/support-<device>-<date-time>.zip

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) The last 12 hours, only the system, service and vService information

admin@TR7LBWAF01> sys-cmd support collect --since 12h --modules system,services,vservices

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) With the least information for a single vService

admin@TR7LBWAF01> sys-cmd support collect --profile minimal --pool <vservice-id>

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) All the content in an encrypted envelope

admin@TR7LBWAF01> sys-cmd support collect --seal

admin@TR7LBWAF01>  

TR7 WEB-CLI · E) With the pseudonym table

admin@TR7LBWAF01> sys-cmd support collect --escrow-map

⚠  You are about to include the pseudonym resolution table in the bundle

    This table holds the REAL values behind the bundle pseudonyms (IPs, hosts, object names, e-mails) and is written only into the encrypted vendor compartment (vendor.tr7) — TR7 support becomes able to de-anonymize the bundle. If you decline, the bundle is produced without the map.

 

Type "yes" to confirm: yes

admin@TR7LBWAF01>  

sys-cmd support list

It lists the support bundles in the temporary file area with the newest at the top. The table columns: Filename, File size, Last modified and Link. The bundle is downloaded from the address in the Link column; the download is written to the user logs.

TR7 WEB-CLI · support list

admin@TR7LBWAF01> sys-cmd support list

# delete the downloaded bundle

admin@TR7LBWAF01> sys-cmd file delete support-<device>-<date-time>.zip

admin@TR7LBWAF01>  

The Content of the Bundle

File or folder	Content
summary.txt	The device, the version, the options, the summary findings, the module results and the notes; plain text
manifest.json	The name, size and digest value of every file in the bundle, the module durations and the notes; plain text
overview/	Summary data for a quick examination
customer/	The content that the modules collect; when --seal is given, this content is moved into the customer.tr7 encrypted envelope
vendor.tr7	The encrypted vendor compartment; it is not produced when --skip-vendor is given or when the encryption key is not found

How It Works

Subject	Behavior
Context	It is not affected by the selected v-device and route table; it always collects from the device itself.
Progress	For every module, [module] collecting... and a result line are written. A module that slows down is skipped at the time limit (60 seconds for the service logs and 20 for the others), the bundle is still produced and the situation is noted in summary.txt.
A single job	Only one bundle is produced at a time; while one is in progress, a second collect is rejected.
Size	The content added to the bundle is at most 256 MB before compression, or the free space in the temporary area minus 64 MB; with --seal the limit is 64 MB. When the limit is reached, the remaining files are skipped and a note is made.
Old bundles	Before a new bundle is produced, the old bundles other than the newest one are deleted; at most two bundles remain in the area.
Timeout	WEB-CLI waits for the bundle for at most 15 minutes.
Recording	The command line and the bundle options are written to the user logs.

The Error Messages

Message	Meaning and solution
Invalid --profile value: '…'. Known: anon, minimal, full	The profile name was written incorrectly
Invalid --since value: '…'. Example: 12h, 7d, 20d	The duration format is wrong; the number and h or d are written adjacent
Invalid module: …. Known: …	The module name was written incorrectly
Invalid vService id.	The --pool value contains a character that is not allowed
A support bundle collection is already running	Another bundle production is in progress; it is waited for to finish
Not enough free space on … Delete files ('file delete') or grow the disk ('file change-size').	There is less than 16 MB of free space in the temporary area; space is freed with file delete or the area is grown with file disk change-size
--seal requested but the support bundle public key is missing	The key needed for the encrypted envelope is not on the device; the bundle is not produced and the command is run again without --seal
Since token too large	The --since value exceeds 30 days
Support bundle job timed out (15 min).	WEB-CLI waited for 15 minutes; the bundle production may continue in the background and it is checked after a while with support list. In the following attempts --since is shortened or it is narrowed with --modules

Things to Know

• --since cannot exceed 30 days. Although a value such as 45d is accepted as a format, the bundle job is not started and gives a Since token too large error.
• --escrow-map is not always useful. Because there are no pseudonyms with the full profile, and there is no vendor compartment with --skip-vendor, the table is not added; this situation is noted in summary.txt. Despite the expression If you decline, the bundle is produced without the map on the confirmation screen, in this version the bundle is not produced at all if confirmation is not given; if the table is not wanted, the command is run again without --escrow-map.
• Before sending the bundle, summary.txt can be opened to see which modules were collected and which notes were made.
• Old bundles with the diag- prefix. support list and the automatic cleanup done while a new bundle is produced cover only the bundles whose name begins with support-. The old diagnostic bundles whose name begins with diag- do not appear in this list and are not deleted by themselves; they are seen with file list and deleted with file delete.
• The bundles are kept in the temporary file area; they are also listed, downloaded and deleted with the file commands.